Start Here
Six practice stations plus a knowledge check, each a different way to work through Chapter 2. Take them in any order. Nothing here is graded or stored, so use it as many times as you like before the quiz or lab.
What this chapter asked you to be able to do
- Explain the role of cryptographic hashing in forensic integrity and describe how MD5, SHA-1, and SHA-256 differ in strength and appropriate use.
- Generate and verify forensically sterile destination media and document the sanitization process.
- Create forensic images in Raw/DD, E01, and AFF4 formats and articulate the trade-offs of each.
- Perform image verification through hash comparison and explain its courtroom significance and its limitations.
- Use NSRL and custom hash sets to filter known files and reduce the scope of an examination.
Your progress this session
These counters update as you check answers on each station. They reset when you reload the page.
Key Terms Flashcards
Select a card to reveal its definition, then select again to flip it back. Try to state the definition before you flip. The counter tracks how many distinct cards you have opened.
Cryptographic Hashing in Forensic Practice
Two short sets. First name the hash property being described, then choose the algorithm or approach that fits the situation.
A. Which property of a hash function is described?
Each statement points to one of the five properties that make hashing useful for forensic integrity.
B. Which algorithm or approach fits?
Choose the algorithm or hashing approach that best matches each description.
Hash Sets and Known-File Filtering
For each file, decide what kind of hash match it represents and what the examiner should do with it. Watch for the case where a known-good file still matters.
Ordering the Imaging Workflow
A forensically sound acquisition follows a fixed order, from preparing the environment through securing the finished image. Give each step its position, from 1 (first) to 7 (last), then check the sequence.
Sterile Media and Image Formats
Two sets. First choose how to sanitize or verify a destination drive, then choose the image format or type that fits each need.
A. How do you sanitize or verify this destination drive?
Match each situation to the right sanitization or verification step.
B. Which image format or type fits?
Choose the format or image type that best matches each requirement.
Reference: image format comparison
| Format | Compression | Metadata | Verification | Typical use |
|---|---|---|---|---|
| Raw / DD | None | None | Hash only | Legacy cases, tool-agnostic scenarios |
| E01 | Yes (50 to 80 percent) | Date, examiner, tool | CRC-32 blocks plus hash | Standard law enforcement and corporate work |
| AFF4 | Optional, multiple streams | Comprehensive | Hash plus multiple options | Long-term archival, academic, progressive agencies |
Guided Terminal: Imaging and Hash Verification
Work through a short imaging and verification sequence one command at a time. Type each command at the prompt and press Enter, or select Run. Use Show hint if you are stuck, or Type it for me to fill the command in. Only the commands in this exercise are accepted.
Knowledge Check
Ten multiple-choice questions across the whole chapter. Answer them all, then select Score my answers for feedback and a final total.